# Filebeat system module to kafka topic **URL:** \ **Category:** Beats\ **Created:** [May 14, 2020, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-system-module-to-kafka-topic/232666 "2020-05-14T14:08:34Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ismyhairnice](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismyhairnice/32/68353_2.png) [@ismyhairnice](https://discuss.elastic.co/u/ismyhairnice)\ **Post date:** [May 14, 2020, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-system-module-to-kafka-topic/232666/1 "2020-05-14T14:08:34Z")
Hi all I have a setup currently sends snort logs to kafka topic and to logstash for ingest. Just wondering if is possible to send Filebeat System module logs to kafka topic ? Regards Yu Feng ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [May 14, 2020, 3:20pm UTC](https://discuss.elastic.co/t/filebeat-system-module-to-kafka-topic/232666/2 "2020-05-14T15:20:42Z")
Hey @ismyhairnice, welcome to discuss 🙂 Yes, you can configure Filebeat to send any logs to a kafka topic, no matter the source of these logs. To collect the system logs you need to enable the system module. ---
**Author:** ![pp42](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pp42/32/68260_2.png) [@pp42](https://discuss.elastic.co/u/pp42)\ **Post date:** [May 14, 2020, 7:09pm UTC](https://discuss.elastic.co/t/filebeat-system-module-to-kafka-topic/232666/3 "2020-05-14T19:09:10Z")
Thanks for your answer Jaime. I have a question regarding logs sent to the kafka output. I would like to design a solution that buffers log sent via Beat agents. Actually if I understand well the beat modules use the pipeline of the Ingest Node and that's how the processing is done. The drawback is that we may lose some logs if our es cluster in unhealthy. I would like to buffers these logs into kafka before sending them to es (Ingest Node pipeline). Do you have an architecture in mind to do that ? I would like to avoid to use Logstash pipeline. Does logstash indexer will read kafka topics et call the appropriate Ingest Node pipeline ? Do you know another tool that does that ? Thanks very much. ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [May 15, 2020, 12:16pm UTC](https://discuss.elastic.co/t/filebeat-system-module-to-kafka-topic/232666/4 "2020-05-15T12:16:42Z")
Logs sent to Kafka by Beats can be collected with Filebeat with the [Kafka input](https://www.elastic.co/guide/en/beats/filebeat/7.7/filebeat-input-kafka.html), and then sent to ES. There is no need to use Logstash. So you can have: Beats -\> Kafka -\> Filebeat -\> ES. Regarding buffering, apart of the previous architecture, each beat has also a local queue that keeps some events in memory in case the output is not available. It can be also configured to spool to disk. Take a look to the documentation for the [internal queue](https://www.elastic.co/guide/en/beats/filebeat/7.7/configuring-internal-queue.html). ---
**Author:** ![pp42](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pp42/32/68260_2.png) [@pp42](https://discuss.elastic.co/u/pp42)\ **Post date:** [May 15, 2020, 12:37pm UTC](https://discuss.elastic.co/t/filebeat-system-module-to-kafka-topic/232666/5 "2020-05-15T12:37:03Z")
Awesome ! Thank you very much Jaime. Will try internal queue (with spool queue in configuration) and if it works well we no longer need Kafka in our architecture 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 12, 2020, 2:37pm UTC](https://discuss.elastic.co/t/filebeat-system-module-to-kafka-topic/232666/6 "2020-06-12T14:37:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.